MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 2aada4aadc19fc7bfd826b05d82a4cd3b651f0096b488b0f8de94483681d5ea8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


RemcosRAT


Vendor detections: 3


Intelligence 3 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 2aada4aadc19fc7bfd826b05d82a4cd3b651f0096b488b0f8de94483681d5ea8
SHA3-384 hash: fe05a0d4b2368cd64960713a87cae7bcd31de5dc3d79ebb83534ce398eccf8042bcefadebc6529434667021cab4e254c
SHA1 hash: 6b09ccd32f094d23453da4bf9123dc462d30f1fb
MD5 hash: ef87dc616e87f100faed19b34059c5bc
humanhash: snake-london-river-cardinal
File name:Giá FOB tính bằng USD..KQ13jvZ9uFZOE8U.iso
Download: download sample
Signature RemcosRAT
Create hunting rule
File size:784'384 bytes
First seen:2021-01-31 07:45:27 UTC
Last seen:Never
File type: iso
MIME type:application/x-iso9660-image
ssdeep 12288:fBeBkAF+bikAttwYNvUTLuBftKnonAinULc/595xGvOn9OFc9fSDK5pi8XYs64tA:fBeBkAeikAPVNvUT6Bftj7ULcB/xG29e
TLSH 99F4F1303298FB61D67FB7781570460013F1E50AD723EB2DBF9C209A6B53E8587A6762
Reporter abuse_ch
Tags:geo iso RAT RemcosRAT VNM


Avatar
abuse_ch
Malspam distributing RemcosRAT:

HELO: vps.asswart.com
Sending IP: 45.85.90.28
From: procurement <office@briglum.com>
Subject: Giá FOB tính bằng USD.
Attachment: Giá FOB tính bằng USD..KQ13jvZ9uFZOE8U.iso (contains "Giá FOB tính bằng USD..KQ13jvZ9uFZOE8U.exe")

RemcosRAT C2:
nwajesu2021.ddns.net

Intelligence

File Origin
# of uploads :
1
# of downloads :
158
Origin country :
n/a
Vendor Threat Intelligence
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/2aada4aadc19fc7bfd826b05d82a4cd3b651f0096b488b0f8de94483681d5ea8/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-01-31 07:46:08 UTC
AV detection:
14 of 46 (30.43%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=fkw2jkw4dh6hx7mcnmc5qksm2o3fd4ajnneiwd4n5fcig2a5l2ua._file
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/2aada4aadc19fc7bfd826b05d82a4cd3b651f0096b488b0f8de94483681d5ea8

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Malspam

RemcosRAT

iso 2aada4aadc19fc7bfd826b05d82a4cd3b651f0096b488b0f8de94483681d5ea8

(this sample)

RemcosRAT

Executable exe 7aef6a3d7f631fc8fb00123ec3842c3d4e4e6c1c6d81a7a9559832f79cc14c9b

  
Dropping
MD5 cd2cd9f833fac58c909e25cfe6ca277e
  
Dropping
RemcosRAT
  
Delivery method
Distributed via e-mail attachment
  
Dropping
SHA256 7aef6a3d7f631fc8fb00123ec3842c3d4e4e6c1c6d81a7a9559832f79cc14c9b

Comments